Skip to main content

​
Bearer JWT

Every API request must include an Authorization header:
The token is scoped to your business account. The JWT sub claim is your business account id. All API resources belong to that account. Each token includes a unique jti claim. Store it when you receive a token so you can revoke it if needed.

​
Obtaining a token

Tokens are issued during onboarding for each environment. Sandbox and production each have their own JWT. See Production and sandbox. Card PINs use a separate encryption flow. See Managing a card’s PIN.

​
Rotating your API token

When you request a new token, your previous token remains valid for 24 hours and then expires automatically. Use the revoke endpoint if you need to invalidate it sooner.

​
Step 1 - Issue a new JWT

POST /api/v1/auth/tokens/rotate
Rotate response
Deploy the new token and confirm API calls succeed.

​
Step 2 - Revoke (optional)

POST /api/v1/auth/tokens/JTI/revoke
Response: { "id": "OLD_JTI" }